T87A Bins to Pins - Who's In ?

[kidturbo]

Tested the U-link CANbus read/write with custom kernel functions. And it works. But I was having issue getting it to load some OS versions. Then I loaded a virgin OS Boot software part number: 24288837 and that allowed full read and write on my properly terminated bench harness. Along with a bit of tech support, found the cause listed in the video comments. We need to help combine these OS differences, into a single T87A custom kernel.
For now, Important>
"If your boot block is 24288837 you can use TCUT87ACAN. If your boot block is 24284338 or 24272182 you need to use TCUT87ACAN1 or you cannot enter DEBUG ON. You can also upgrade your boot block to 24288837 independent of what the rest flash is."

With a little code work to hush neighboring bus traffic, I believe this custom kernel option could handle SPS level segment full or cal flashing over OBD2 port same as all the big tools. Uses OBD2 commands, and doesn't seem to require any special pinout, or care about being wired to transmission. So once it hits the bus, all just 1's and 0's again anyways. Much potential..

[usbbdm]

" So once it hits the bus, all just 1's and 0's"
Well said.

[Tre-Cool]

i had entirely forgot that i had purchased 2 of the u-links since i had never got around to opening up an e38, so they've been sitting in my desk drawer at the workshop.

As i have an E38 that would get hot and do wierd stuff in a car & was fixed by replacing it, I have a good candidate test opening the case on.

Got me wondering if the global-b E90/9 unlocks are on the cards in the future?

[Tre-Cool]

well I spent $640 on ebay by ordering an e90,t93 & t87a. for when i get around to doing something with a 10 speed & L87 engine in the next few years...

[kidturbo]

Sorry, I've been busy breaking the T87A six ways from Sunday. Not sure why yet, but am finding some weird stuff happening between different 10L OS. Like one version drives and shifts normal, next one goes from 1st to Neutral. All in same stand alone environment, receiving same CANbus data. Turning off certain DTC's, might actually cause new unforeseen problems. It's certainly been a time consuming little unit. Happy on the bench, pissy in the car.. I believe there's some hardware specific data hiding outside our normal SRAM reading range. Might worth exploring. That and some OS related unlock issues still need resolved on these. So jump on in..

On the T93's. I have one cracked open, but haven't isolated which pads are which on the JTAG. However, I have learned they are being unlocked by reflash using CAN FD mode. So another new tool on the way.

[Tre-Cool]

my ecu/tcm's arrived while i've been away for work, along with the can interface module to do them. I might have a play while im home.

Also found a place that sells a 10l80/90 to tcm harness for $110usd. gonna have to send them an email as they don't list international shipping.
https://topstreetperformance.com/produc ... ng-harness

Or do you know of anyone else selling the above? edit. looks like you got em on your website now. Nice.

edit v2. come across this tonight.
https://www.lojkits.com/products/10l80e ... wd-adapter

Cheaper then trying to get a 6l80 setup done as i have transfer case and all the front diff setup already.

[kidturbo]

Nice find on the parts. I really like that transfer case kit..

Another member has recently stuffed a 10L into a Chev SS, keeping the 2 piece driveshaft intact. Thought that was pretty slick trick.

Speaking of transfer case and 10L, I recently discovered the main stickler on these swaps comes down to our range switch changes with the 10L and E92. As posted page 1, the 10R and 10L uses 2 x 20-80% duty lines to determine the shift lever position. 3 wires went to the E92, one to the T87A.

For the 10L T87A OS to engage any gears, Range A/B Correlation must be achieved at Key On.. Much like APPS, if A/B not happy at key on, it's not happy at until that TCM module resets. Sometimes full a power down. And turning off that DTC, only masks the issue...

At Key On the TCM checks for CANbus msg 0x287 "Transfer Case Supp" with the ECM supplied range position, in a value of 80-20% that is opposite of what the TCM is reading on it's signal line. If those don't match within first second, the A/B correlation code is set. If they don't match, nothing else matters to the TCM. It broadcast an Invalid Range Switch to all nodes, and refuses to engage. Safety thing I'm sure..

However,, if there is no 0x287 msg on the CANbus, 10L engages just fine.. Curious, and sure a safety to get ya rolling based off just the TCM range position value if CANbus goes down. But if you send that TCM any junk 0x287 msg, kills it on the spot again within couple seconds...

After a few hours on bench rebooting the TCM every 10 seconds and retesting, I realized most all GMLAN signals of importance, also have a Validity bit. That bit, well documented in the PDF files, tells all other nodes if the data related to this signal is Valid or Invalid.. Not having those bytes or range values mapped correctly in my DBC, didn't help solve it. But a little data Fuzzing sure did...

Find the correct bit, telling the TCM our range data from ECM is junk, and the TCM never sets a code or complains. It continues on happily based on only the single range value from range switch. Leaving several ways so solve this based upon platform. Hardest is OS that send this transfer case msg in wrong byte length. I proved TCM will accept being Padded with correct Invalid Validity bit on the bench. An ADC converter reading the range in place of the ECM and sending a proper mate signal has been floated. But killing the DTC gets you nowhere on this one. So be sure to consider this the #1 thing to sort first on any swaps.. And first code to look for if it won't move...

[kidturbo]

Quick update to the last post.
Spent last weekend testing on a Holley Domminator car running a full CANbus gateway to the T87A in a stand alone mode, on a chassis dyno. Which is way easier than flying passenger seat of the pants, with a laptop in one hand at 100mph..

Was able to grab a fair bit of raw data, along with some detailed HPT shifting logs. Main goal was mapping out torque values at rear wheel that were reasonably valid, since the Holley ECM doesn't produce any. With that accomplished, the car shifts and drives decent as is, with only BCM and EBCM codes written out. So we moved on to testing different TCM OS versions and cleaning up the torque management parts, since the 10L transmissions don't seem to limp on slips.. And learned these units will slip the clutches if over powered on the big end, 8/9/10 with no reduction on the shifts..

What else checked out good was the range switch message trick I listed above. By sending an 0x20 for Byte3 [3rd bit only] in msg 0x287, it never complains about any range switch conflicts. There is also two rolling counters in Byte0, which I have active, but not certain they are required. So if anyone wants to test this theory, spoof the range switch msg with just this 1 bit ON, and I think it should engage gears happy.. I have also tested it with modified TCM bin and shortening the required 0x287 msg to 3 bytes only, or even removing from the required RX list also shows promise. The other option, if using an ECM which already TX the 0x287 msg, find this 1 bit and flip it, range switch issues resolved. Here is an example raw CANbus capture from the dyno.

Screenshot 2025-06-28 015233.png

[kostia111]

Good day
Sorry that it's not quite on topic
Maybe one of the participants
has an HPT file for T87A with OS 24297414
Any with this OS, calibrations don't matter
I have a full image in BIN
I need HPT

[kidturbo]

Haven't ran into that OS # yet.
What platform is that one from?